NASA Spacecraft Control Software Exposed by Flaws Allowing Command Takeover

Security researchers at Cycode have uncovered a chain of vulnerabilities in AIT-GUI, the browser-based operator console for NASA's open-source AMMOS Instrument Toolkit, that would let an attacker without credentials issue arbitrary commands to spacecraft and instrument control systems. The flaw chain, published in an advisory on August 13, 2026, earned a severity rating of 9.4 on the CVSS v3.1 scale. The AMMOS Instrument Toolkit is a framework for building ground data systems—software that transmits commands to spacecraft and instruments and processes the telemetry they send back.

The vulnerability chain affects AIT-GUI versions 2.5.1 and earlier, according to the advisory tracked as GHSA-p9r8-2q67-fp86. The web server reads its configured host value but then discards it, binding the listener to the hardcoded address 0.0.0.0 on port 8080 by default, and exposes command, script, and sequence routes without credential-based authentication, authorization, or cross-site request forgery protection. While the routes are gated by a session cookie, a session can be obtained without credentials simply by requesting the root page. Two of those routes also construct filesystem paths from unvalidated input. An unauthenticated party who can reach the port can issue arbitrary instrument and spacecraft commands via POST /cmd, execute server-side scripts via POST /script/run including files outside the intended directory through path traversal, and run command sequences via POST /seq including out-of-directory files passed to a subprocess, the issues classified as CWE-306, CWE-352, and CWE-22. A request to POST /cmd without a valid session cookie returns HTTP 401, but GET / calls Sessions.create() and returns a sid cookie without requiring credentials, and repeating the command request with that cookie passes the session check and sends the command.

"A web GUI used to drive spacecraft and instrument commanding shipped a server that listens on every network interface, asks nobody for a password, and can be steered by any web page an operator happens to open," Yuval Elbar, a security researcher at Cycode, said. The proof-of-concept for the cross-origin portion of the chain was run on localhost, and because the routes accept application/x-www-form-urlencoded bodies, which browsers treat as CORS "simple" requests, a cross-origin POST can be delivered without a preflight and processed by the server, Cycode said. AIT-GUI 2.5.2 was released on August 12, 2026, and binds the configured host defaulting to localhost, adds a before_request hook that compares a request's Origin or Referer against the server's own Host for POST, PUT, DELETE, and PATCH, and confines /script/run and /seq to their configured roots. However, The Hacker News confirmed against the tagged 2.5.2 source on August 20, 2026, that the root route still calls Sessions.create() and issues a session cookie to any request without a credential check, and the command route accepts any request carrying that cookie.

Cycode told The Hacker News it doesn't consider the chain fully remediated in 2.5.2, saying the release addresses the remote exposure and cross-site delivery paths but leaves the missing-authentication weakness intact. The Hacker News also confirmed via PyPI on August 20, 2026, that the latest published release of the ait-gui package is 2.4.1, uploaded on July 27, 2023, and that versions 2.5.0, 2.5.1, and 2.5.2 don't appear in the release history. A second record, CVE-2026-60112 rated 9.3 on CVSS v4, was published to the National Vulnerability Database and the GitHub Advisory Database on July 29, 2026, three weeks before the Cycode writeup, covering the same missing-authentication defect in the same file. The two records disagree on the fix, with VulnCheck and the NVD entry placing the flaw in versions before 2.5.1 and citing commit beb8fc0 as the patch, while the Cycode advisory lists 2.5.1 as affected and 2.5.2 as the fixed release. Cycode characterized CVE-2026-60112 as covering the credential-free session issuance and arbitrary command primitive, while its advisory reports a broader chain combining that weakness with cross-origin/CSRF delivery and the path traversal issue on /seq. Neither record names a mission running the software, nor does either report exploitation. Organizations running ground control systems that rely on perimeter defenses alone may find themselves vulnerable to operators unwittingly loading malicious web pages that exploit the console's trust model. The browser-based attack surface creates a path for compromise that doesn't require direct network penetration, shifting the threat model from purely external attackers to scenarios where social engineering or watering-hole attacks could weaponize legitimate operator sessions.